Your GDPR rights as a survey panel member

Why the GDPR matters for panel members

A survey panel holds several kinds of information about you: your contact details, your profile answers, your study history and your rewards. Under the GDPR, all of this is personal data, and the panel must have a lawful reason to use it, keep it secure, keep it accurate and keep it no longer than necessary.

Some profile questions involve what the GDPR calls special category data, such as health, ethnicity, religion or sexual orientation. These have extra protection. Panels should only ask for them with your explicit consent and should always make them optional.

This article is general information, not legal advice. Your national data protection authority publishes official guidance.

Consent, and taking it back

Panels usually rely on your consent for joining, for receiving invitations and for any optional profile data. Consent must be freely given, specific and informed, and it must be as easy to withdraw as it was to give.

Withdrawing consent stops future use of your data for that purpose. It does not make past processing unlawful, and in practice it usually means you will stop receiving invitations.

Your rights, one by one

Right of access

You can ask for a copy of the personal data a panel holds about you, along with information about how it is used, who it is shared with and how long it is kept. This is often called a subject access request.

Right to rectification

If any data is wrong or incomplete, you can ask for it to be corrected. Panels also let you update most of your profile yourself.

Right to erasure

Sometimes called the right to be forgotten. You can ask for your data to be deleted, for example when you leave the panel. Some records may be kept where there is a legal reason, such as tax records for payments made to you or records needed to prevent fraud.

Right to restrict processing

You can ask a panel to pause the use of your data in certain situations, for example while it checks whether your data is accurate.

Right to data portability

You can ask for data you provided to be given to you in a common, machine-readable format, such as a spreadsheet file.

Right to object

You can object to processing based on the organization's legitimate interests, and you can always object to direct marketing.

What about survey answers already used?

Your answers are usually combined with others and, once a study is finished, often anonymized. Anonymous data is no longer personal data, so it falls outside the GDPR. That means deleting your account removes your identity from the panel, but it may not remove your contribution from results that were already reported anonymously. A clear privacy notice explains this.

How to make a request

• Use the email address linked to your account, so the panel can confirm it is really you.
• Say which right you are using, for example "This is a subject access request".
• Be specific if you only need part of your data.
• Keep a note of the date.

Organizations normally have one month to respond. For complex requests, they can extend this by up to two more months, but they must tell you why. Requests are usually free.

If you are not satisfied

Start by contacting the panel's privacy team, which should be listed in its privacy policy. If that does not resolve the issue, you have the right to complain to a data protection authority, such as the supervisory authority in your EU country or the Information Commissioner's Office in the UK.

What about the UK?

After leaving the EU, the UK kept the GDPR in its own law, known as the UK GDPR, alongside the Data Protection Act 2018. The rights described here are essentially the same for UK residents.

Common questions

Does the GDPR apply if the panel is based outside Europe?

Yes, if the panel offers its services to people in the EU or UK. Organizations outside Europe may also appoint a representative in the EU or UK for data protection questions.

Can a panel refuse my request?

Only in limited situations, for example if a request is clearly unfounded or excessive, or if keeping some data is legally required. The panel must explain its reasons and tell you about your right to complain.

Will I lose my rewards if I ask for deletion?

Check the panel's terms first. Many panels ask you to redeem any balance before closing your account, because a balance cannot be paid once your details are gone.